{ config, ... }:
{
  security.acme.acceptTerms = true;
  networking.firewall.allowedTCPPorts = [ 80 ];
  services.nginx.virtualHosts.${config.mailserver.fqdn}.enableACME = true;

  mailserver = {
    enable = true;
    stateVersion = 4;
    fqdn = "mail.billenius.com";
    domains = [ "billenius.com" ];

    x509.useACMEHost = config.mailserver.fqdn;

    # A list of all login accounts. To create the password hashes, use
    # nix-shell -p mkpasswd --run 'mkpasswd -s'
    accounts = {
      "love@billenius.com" = {
        hashedPasswordFile = ./mail-password-hash/love@billenius.com;
        aliases = [ "postmaster@billenius.com" ];
      };
    };
  };
}